Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 01:00
Behavioral task
behavioral1
Sample
00bf0bd9873539b2b17493d43fcf9aa0.dll
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
00bf0bd9873539b2b17493d43fcf9aa0.dll
Resource
win10v2004-20240426-en
5 signatures
150 seconds
General
-
Target
00bf0bd9873539b2b17493d43fcf9aa0.dll
-
Size
76KB
-
MD5
00bf0bd9873539b2b17493d43fcf9aa0
-
SHA1
0e811c7a93dc08e0e1bac1f19ca4e6efdfab2284
-
SHA256
6e8ca33521b1327e2e80dd62f89c13ae5635bd3c77b117414be1b1073872bad1
-
SHA512
d7b6d1c06d1e79dd1521a14c9daef0b964b9d90e655a3f5d831834451706799742612904b8ebe88a92be88097a5b7427dab41bd9da4c7d4337a25deceb9268fd
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZCR2+i:c8y93KQjy7G55riF1cMo03gR2+i
Score
8/10
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/memory/760-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/760-3-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2472 760 WerFault.exe 80 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 760 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1448 wrote to memory of 760 1448 rundll32.exe 80 PID 1448 wrote to memory of 760 1448 rundll32.exe 80 PID 1448 wrote to memory of 760 1448 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bf0bd9873539b2b17493d43fcf9aa0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bf0bd9873539b2b17493d43fcf9aa0.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 7003⤵
- Program crash
PID:2472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 760 -ip 7601⤵PID:4688